S3CodeV2

class aws_cdk.aws_lambda.S3CodeV2(bucket, key, *, object_version=None, source_kms_key=None)

Bases: Code

Lambda code from an S3 archive.

With option to set KMSKey for encryption.

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_kms as kms
from aws_cdk import aws_lambda as lambda_
from aws_cdk import aws_s3 as s3

# bucket: s3.Bucket
# key: kms.Key

s3_code_v2 = lambda_.S3CodeV2(bucket, "key",
    object_version="objectVersion",
    source_kMSKey=key
)
Parameters:
  • bucket (IBucket) –

  • key (str) –

  • object_version (Optional[str]) – Optional S3 object version.

  • source_kms_key (Optional[IKey]) – The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.

Methods

bind(_scope)

Called when the lambda or layer is initialized to allow this object to bind to the stack, add resources and have fun.

Parameters:

_scope (Construct) –

Return type:

CodeConfig

bind_to_resource(_resource, *, resource_property=None)

Called after the CFN function resource has been created to allow the code class to bind to it.

Specifically it’s required to allow assets to add metadata for tooling like SAM CLI to be able to find their origins.

Parameters:
  • _resource (CfnResource) –

  • resource_property (Optional[str]) – The name of the CloudFormation property to annotate with asset metadata. Default: Code

Return type:

None

Attributes

is_inline

Determines whether this Code is inline code or not.

Static Methods

classmethod from_asset(path, *, deploy_time=None, readers=None, source_kms_key=None, asset_hash=None, asset_hash_type=None, bundling=None, exclude=None, follow_symlinks=None, ignore_mode=None)

Loads the function code from a local disk path.

Parameters:
  • path (str) – Either a directory with the Lambda code bundle or a .zip file.

  • deploy_time (Optional[bool]) – Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false

  • readers (Optional[Sequence[IGrantable]]) – A list of principals that should be able to read this asset from S3. You can use asset.grantRead(principal) to grant read permissions later. Default: - No principals that can read file asset.

  • source_kms_key (Optional[IKey]) – The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.

  • asset_hash (Optional[str]) – Specify a custom hash for this asset. If assetHashType is set it must be set to AssetHashType.CUSTOM. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on assetHashType

  • asset_hash_type (Optional[AssetHashType]) – Specifies the type of hash to calculate for this asset. If assetHash is configured, this option must be undefined or AssetHashType.CUSTOM. Default: - the default is AssetHashType.SOURCE, but if assetHash is explicitly specified this value defaults to AssetHashType.CUSTOM.

  • bundling (Union[BundlingOptions, Dict[str, Any], None]) – Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at /asset-input. The Docker container is responsible for putting content at /asset-output. The content at /asset-output will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise

  • exclude (Optional[Sequence[str]]) – File paths matching the patterns will be excluded. See ignoreMode to set the matching behavior. Has no effect on Assets bundled using the bundling property. Default: - nothing is excluded

  • follow_symlinks (Optional[SymlinkFollowMode]) – A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER

  • ignore_mode (Optional[IgnoreMode]) – The ignore behavior to use for exclude patterns. Default: IgnoreMode.GLOB

Return type:

AssetCode

classmethod from_asset_image(directory, *, cmd=None, entrypoint=None, working_directory=None, asset_name=None, build_args=None, build_secrets=None, build_ssh=None, cache_disabled=None, cache_from=None, cache_to=None, file=None, invalidation=None, network_mode=None, outputs=None, platform=None, target=None, extra_hash=None, exclude=None, follow_symlinks=None, ignore_mode=None)

Create an ECR image from the specified asset and bind it as the Lambda code.

Parameters:
  • directory (str) – the directory from which the asset must be created.

  • cmd (Optional[Sequence[str]]) – Specify or override the CMD on the specified Docker image or Dockerfile. This needs to be in the ‘exec form’, viz., [ 'executable', 'param1', 'param2' ]. Default: - use the CMD specified in the docker image or Dockerfile.

  • entrypoint (Optional[Sequence[str]]) – Specify or override the ENTRYPOINT on the specified Docker image or Dockerfile. An ENTRYPOINT allows you to configure a container that will run as an executable. This needs to be in the ‘exec form’, viz., [ 'executable', 'param1', 'param2' ]. Default: - use the ENTRYPOINT in the docker image or Dockerfile.

  • working_directory (Optional[str]) – Specify or override the WORKDIR on the specified Docker image or Dockerfile. A WORKDIR allows you to configure the working directory the container will use. Default: - use the WORKDIR in the docker image or Dockerfile.

  • asset_name (Optional[str]) – Unique identifier of the docker image asset and its potential revisions. Required if using AppScopedStagingSynthesizer. Default: - no asset name

  • build_args (Optional[Mapping[str, str]]) – Build args to pass to the docker build command. Since Docker build arguments are resolved before deployment, keys and values cannot refer to unresolved tokens (such as lambda.functionArn or queue.queueUrl). Default: - no build args are passed

  • build_secrets (Optional[Mapping[str, str]]) – Build secrets. Docker BuildKit must be enabled to use build secrets. Default: - no build secrets

  • build_ssh (Optional[str]) – SSH agent socket or keys to pass to the docker build command. Docker BuildKit must be enabled to use the ssh flag Default: - no –ssh flag

  • cache_disabled (Optional[bool]) – Disable the cache and pass --no-cache to the docker build command. Default: - cache is used

  • cache_from (Optional[Sequence[Union[DockerCacheOption, Dict[str, Any]]]]) – Cache from options to pass to the docker build command. Default: - no cache from options are passed to the build command

  • cache_to (Union[DockerCacheOption, Dict[str, Any], None]) – Cache to options to pass to the docker build command. Default: - no cache to options are passed to the build command

  • file (Optional[str]) – Path to the Dockerfile (relative to the directory). Default: ‘Dockerfile’

  • invalidation (Union[DockerImageAssetInvalidationOptions, Dict[str, Any], None]) – Options to control which parameters are used to invalidate the asset hash. Default: - hash all parameters

  • network_mode (Optional[NetworkMode]) – Networking mode for the RUN commands during build. Support docker API 1.25+. Default: - no networking mode specified (the default networking mode NetworkMode.DEFAULT will be used)

  • outputs (Optional[Sequence[str]]) – Outputs to pass to the docker build command. Default: - no outputs are passed to the build command (default outputs are used)

  • platform (Optional[Platform]) – Platform to build for. Requires Docker Buildx. Default: - no platform specified (the current machine architecture will be used)

  • target (Optional[str]) – Docker target to build to. Default: - no target

  • extra_hash (Optional[str]) – Extra information to encode into the fingerprint (e.g. build instructions and other inputs). Default: - hash is only based on source content

  • exclude (Optional[Sequence[str]]) – File paths matching the patterns will be excluded. See ignoreMode to set the matching behavior. Has no effect on Assets bundled using the bundling property. Default: - nothing is excluded

  • follow_symlinks (Optional[SymlinkFollowMode]) – A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER

  • ignore_mode (Optional[IgnoreMode]) – The ignore behavior to use for exclude patterns. Default: IgnoreMode.GLOB

Return type:

AssetImageCode

classmethod from_bucket(bucket, key, object_version=None)

Lambda handler code as an S3 object.

Parameters:
  • bucket (IBucket) – The S3 bucket.

  • key (str) – The object key.

  • object_version (Optional[str]) – Optional S3 object version.

Return type:

S3Code

classmethod from_bucket_v2(bucket, key, *, object_version=None, source_kms_key=None)

Lambda handler code as an S3 object.

Parameters:
  • bucket (IBucket) – The S3 bucket.

  • key (str) – The object key.

  • object_version (Optional[str]) – Optional S3 object version.

  • source_kms_key (Optional[IKey]) – The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.

Return type:

S3CodeV2

classmethod from_cfn_parameters(*, bucket_name_param=None, object_key_param=None, source_kms_key=None)

Creates a new Lambda source defined using CloudFormation parameters.

Parameters:
  • bucket_name_param (Optional[CfnParameter]) – The CloudFormation parameter that represents the name of the S3 Bucket where the Lambda code will be located in. Must be of type ‘String’. Default: a new parameter will be created

  • object_key_param (Optional[CfnParameter]) – The CloudFormation parameter that represents the path inside the S3 Bucket where the Lambda code will be located at. Must be of type ‘String’. Default: a new parameter will be created

  • source_kms_key (Optional[IKey]) – The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.

Return type:

CfnParametersCode

Returns:

a new instance of CfnParametersCode

classmethod from_custom_command(output, command, *, command_options=None, deploy_time=None, readers=None, source_kms_key=None, asset_hash=None, asset_hash_type=None, bundling=None, exclude=None, follow_symlinks=None, ignore_mode=None)

Runs a command to build the code asset that will be used.

Parameters:
  • output (str) – Where the output of the command will be directed, either a directory or a .zip file with the output Lambda code bundle * For example, if you use the command to run a build script (e.g., [ ‘node’, ‘bundle_code.js’ ]), and the build script generates a directory /my/lambda/code containing code that should be ran in a Lambda function, then output should be set to /my/lambda/code.

  • command (Sequence[str]) – The command which will be executed to generate the output, for example, [ ‘node’, ‘bundle_code.js’ ].

  • command_options (Optional[Mapping[str, Any]]) – options that are passed to the spawned process, which determine the characteristics of the spawned process. Default: : see child_process.SpawnSyncOptions (https://nodejs.org/api/child_process.html#child_processspawnsynccommand-args-options).

  • deploy_time (Optional[bool]) – Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false

  • readers (Optional[Sequence[IGrantable]]) – A list of principals that should be able to read this asset from S3. You can use asset.grantRead(principal) to grant read permissions later. Default: - No principals that can read file asset.

  • source_kms_key (Optional[IKey]) – The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.

  • asset_hash (Optional[str]) – Specify a custom hash for this asset. If assetHashType is set it must be set to AssetHashType.CUSTOM. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on assetHashType

  • asset_hash_type (Optional[AssetHashType]) – Specifies the type of hash to calculate for this asset. If assetHash is configured, this option must be undefined or AssetHashType.CUSTOM. Default: - the default is AssetHashType.SOURCE, but if assetHash is explicitly specified this value defaults to AssetHashType.CUSTOM.

  • bundling (Union[BundlingOptions, Dict[str, Any], None]) – Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at /asset-input. The Docker container is responsible for putting content at /asset-output. The content at /asset-output will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise

  • exclude (Optional[Sequence[str]]) – File paths matching the patterns will be excluded. See ignoreMode to set the matching behavior. Has no effect on Assets bundled using the bundling property. Default: - nothing is excluded

  • follow_symlinks (Optional[SymlinkFollowMode]) – A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER

  • ignore_mode (Optional[IgnoreMode]) – The ignore behavior to use for exclude patterns. Default: IgnoreMode.GLOB

Return type:

AssetCode

classmethod from_docker_build(path, *, image_path=None, output_path=None, build_args=None, cache_disabled=None, cache_from=None, cache_to=None, file=None, platform=None, target_stage=None)

Loads the function code from an asset created by a Docker build.

By default, the asset is expected to be located at /asset in the image.

Parameters:
  • path (str) – The path to the directory containing the Docker file.

  • image_path (Optional[str]) – The path in the Docker image where the asset is located after the build operation. Default: /asset

  • output_path (Optional[str]) – The path on the local filesystem where the asset will be copied using docker cp. Default: - a unique temporary directory in the system temp directory

  • build_args (Optional[Mapping[str, str]]) – Build args. Default: - no build args

  • cache_disabled (Optional[bool]) – Disable the cache and pass --no-cache to the docker build command. Default: - cache is used

  • cache_from (Optional[Sequence[Union[DockerCacheOption, Dict[str, Any]]]]) – Cache from options to pass to the docker build command. Default: - no cache from args are passed

  • cache_to (Union[DockerCacheOption, Dict[str, Any], None]) – Cache to options to pass to the docker build command. Default: - no cache to args are passed

  • file (Optional[str]) – Name of the Dockerfile, must relative to the docker build path. Default: Dockerfile

  • platform (Optional[str]) – Set platform if server is multi-platform capable. Requires Docker Engine API v1.38+. Example value: linux/amd64 Default: - no platform specified

  • target_stage (Optional[str]) – Set build target for multi-stage container builds. Any stage defined afterwards will be ignored. Example value: build-env Default: - Build all stages defined in the Dockerfile

Return type:

AssetCode

classmethod from_ecr_image(repository, *, cmd=None, entrypoint=None, tag=None, tag_or_digest=None, working_directory=None)

Use an existing ECR image as the Lambda code.

Parameters:
  • repository (IRepository) – the ECR repository that the image is in.

  • cmd (Optional[Sequence[str]]) – Specify or override the CMD on the specified Docker image or Dockerfile. This needs to be in the ‘exec form’, viz., [ 'executable', 'param1', 'param2' ]. Default: - use the CMD specified in the docker image or Dockerfile.

  • entrypoint (Optional[Sequence[str]]) – Specify or override the ENTRYPOINT on the specified Docker image or Dockerfile. An ENTRYPOINT allows you to configure a container that will run as an executable. This needs to be in the ‘exec form’, viz., [ 'executable', 'param1', 'param2' ]. Default: - use the ENTRYPOINT in the docker image or Dockerfile.

  • tag (Optional[str]) – (deprecated) The image tag to use when pulling the image from ECR. Default: ‘latest’

  • tag_or_digest (Optional[str]) – The image tag or digest to use when pulling the image from ECR (digests must start with sha256:). Default: ‘latest’

  • working_directory (Optional[str]) – Specify or override the WORKDIR on the specified Docker image or Dockerfile. A WORKDIR allows you to configure the working directory the container will use. Default: - use the WORKDIR in the docker image or Dockerfile.

Return type:

EcrImageCode

classmethod from_inline(code)

Inline code for Lambda handler.

Parameters:

code (str) – The actual handler code (limited to 4KiB).

Return type:

InlineCode

Returns:

LambdaInlineCode with inline code.